This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-geometry.git
The following commit(s) were added to refs/heads/master by this push:
new f6e9e068 Harden XML output via commons-secure-xml (#300)
f6e9e068 is described below
commit f6e9e068cac08b11deb03aa2cc7855d8ea387c63
Author: Piotr P. Karwasz <[email protected]>
AuthorDate: Sun Sep 6 15:21:59 2026 +0200
Harden XML output via commons-secure-xml (#300)
* Harden XML output via commons-secure-xml
Create the tutorial SVG writer's document builder and transformer
factories through org.apache.commons:commons-secure-xml. The secure
factories enable FEATURE_SECURE_PROCESSING and bound resource usage,
regardless of the JAXP implementation on the classpath. The writer only
builds an in-memory DOM and serializes it, so the generated SVG is
unchanged.
Changes:
- Add the commons-secure-xml dependency (1.0.0-SNAPSHOT until its first
release) to the examples-tutorials module.
- Route factory creation through SecureDocumentBuilderFactory and
SecureTransformerFactory in BSPTreeSVGWriter.
- Run the CI build with -Puse-apache-snapshots (inherited from the
org.apache:apache parent POM) so the commons-secure-xml SNAPSHOT
resolves when the examples profile is active.
Assisted-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MHgnMnGWHQoH2zD2jFdoMT
* Use the Commons Secure XML 1.0.0 release candidate
Bump org.apache.commons:commons-secure-xml from 1.0.0-SNAPSHOT to 1.0.0
and add the temporary staging repository
https://repository.apache.org/content/repositories/orgapachecommons-1962/
after Central, so the vote gets downstream CI results. Drop the
-Puse-apache-snapshots profile from the CI workflows, which the release
version no longer needs. Remove the staging repository once 1.0.0 is
released.
Assisted-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_0167e29ScPEdfzJnEFm95imK
* Clean up pom.xml by removing repositories section
Removed unnecessary repository definitions from pom.xml.
* Enhance action element with due-to attribute
Added 'due-to' attribute to action element for clarity.
---------
Co-authored-by: Gary Gregory <[email protected]>
---
commons-geometry-examples/examples-tutorials/pom.xml | 6 ++++++
.../commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java | 6 ++++--
src/changes/changes.xml | 4 ++++
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/commons-geometry-examples/examples-tutorials/pom.xml
b/commons-geometry-examples/examples-tutorials/pom.xml
index ba3c483f..bee4bff8 100644
--- a/commons-geometry-examples/examples-tutorials/pom.xml
+++ b/commons-geometry-examples/examples-tutorials/pom.xml
@@ -67,6 +67,12 @@
<artifactId>commons-geometry-io-euclidean</artifactId>
</dependency>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-secure-xml</artifactId>
+ <version>1.0.0</version>
+ </dependency>
+
<!-- testing -->
<dependency>
<groupId>org.junit.jupiter</groupId>
diff --git
a/commons-geometry-examples/examples-tutorials/src/main/java/org/apache/commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java
b/commons-geometry-examples/examples-tutorials/src/main/java/org/apache/commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java
index 3325d979..c2b239b4 100644
---
a/commons-geometry-examples/examples-tutorials/src/main/java/org/apache/commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java
+++
b/commons-geometry-examples/examples-tutorials/src/main/java/org/apache/commons/geometry/examples/tutorials/bsp/BSPTreeSVGWriter.java
@@ -46,6 +46,8 @@ import org.apache.commons.geometry.euclidean.twod.Vector2D;
import org.apache.commons.geometry.euclidean.twod.path.LinePath;
import org.apache.commons.geometry.euclidean.twod.shape.Parallelogram;
import org.apache.commons.numbers.core.Precision;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
@@ -209,7 +211,7 @@ public class BSPTreeSVGWriter {
*/
public void write(final RegionBSPTree2D tree, final Map<RegionNode2D,
String> nodeNames, final File file) {
try {
- final DocumentBuilderFactory docBuilderFactory =
DocumentBuilderFactory.newInstance();
+ final DocumentBuilderFactory docBuilderFactory =
SecureDocumentBuilderFactory.newInstance();
final DocumentBuilder docBuilder =
docBuilderFactory.newDocumentBuilder();
final Document doc = docBuilder.newDocument();
@@ -236,7 +238,7 @@ public class BSPTreeSVGWriter {
writeTreeStructureArea(tree, nodeNames, root, doc);
// output to the target file
- final TransformerFactory transformerFactory =
TransformerFactory.newInstance();
+ final TransformerFactory transformerFactory =
SecureTransformerFactory.newInstance();
final Transformer transformer =
transformerFactory.newTransformer();
transformer.setOutputProperty(OutputKeys.INDENT, "yes");
transformer.setOutputProperty(INDENT_AMOUNT_KEY,
String.valueOf(INDENT_AMOUNT));
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 2b896cf4..24f81417 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -63,6 +63,10 @@ Apache Commons Geometry 1.0 contains the following library
modules:
commons-geometry-io-core (requires Java 8+)
commons-geometry-io-euclidean (requires Java 8+)
">
+ <action dev="pkarwasz" type="fix" due-to="Piotr P. Karwasz, Gary
Gregory">
+ Create XML documents and transformers in the tutorial SVG writer
through
+ org.apache.commons:commons-secure-xml, so they run with XML secure
processing enabled.
+ </action>
<action dev="aherbert" type="update" due-to="Ivan Shuba">
Fix hash code collision for Vector2D and Vector3D. Modifies the
hashCode() method to reduce collision for non-identical instances of
vectors.
